107 Vulnerabilities Patched, Including 35 RCE Flaws

Microsoft has rolled out its August 2025 Patch Tuesday fixes, addressing a total of 107 vulnerabilities across its ecosystem.

This month’s release stands out for its sheer volume and the inclusion of 35 remote code execution (RCE) bugs, which could allow attackers to run malicious code on affected systems.

While none of these vulnerabilities are currently known to be exploited in the wild, the patches underscore the ongoing battle against evolving cyber threats.

The Microsoft security updates span a wide array of Microsoft products, from core Windows components to Office applications, Azure services, and even specialized tools like Exchange Server and SQL Server.

Security experts recommend immediate patching, especially for organizations relying on hybrid or cloud environments, as delays could expose systems to potential risks.

Critical Vulnerabilities Patched

Out of the 107 issues, 13 are rated Critical, the highest severity level, posing severe risks if left unaddressed. These primarily involve RCE vulnerabilities that could lead to complete system compromise.

For instance, CVE-2025-50165 affects the Windows Graphics Component, enabling unauthorized code execution over a network via untrusted pointer dereferences. Similarly, CVE-2025-53766 targets GDI+ with a heap-based buffer overflow, allowing remote attacks.

Azure users should note CVE-2025-53781, a critical information disclosure flaw in Azure Virtual Machines that could leak sensitive data to unauthorized actors.

Another notable vulnerability is CVE-2025-48807 in Windows Hyper-V, which permits local code execution through improper endpoint restrictions.

These critical bugs highlight vulnerabilities in virtualization and cloud infrastructure, areas increasingly targeted by sophisticated adversaries.

The bulk of the patches, around 90, are classified as Important, covering a mix of elevation of privilege (EoP), denial of service (DoS), spoofing, and information disclosure issues.

EoP flaws dominate this category, with 35 instances allowing attackers to gain higher system privileges.

Examples include CVE-2025-53778 in Windows NTLM, which exploits improper authentication for network-based privilege escalation, and multiple SQL Server bugs like CVE-2025-49758, stemming from SQL injection weaknesses.

RCE vulnerabilities make up a notable 35 of the total, affecting products like Microsoft Office, Exchange Server, and Routing and Remote Access Service (RRAS).

In Office alone, flaws such as CVE-2025-53731 (use-after-free in Microsoft Office) and CVE-2025-53741 (heap-based buffer overflow in Excel) could enable local code execution if users open malicious files.

Windows RRAS sees several heap-based overflows, like CVE-2025-50160, potentially leading to remote exploits.

Lower-severity issues include two Moderate vulnerabilities, such as CVE-2025-53779 in Windows Kerberos involving relative path traversal for EoP, and one Low spoofing flaw in Microsoft Edge for Android (CVE-2025-49755). While less urgent, these still warrant attention to prevent cumulative risks.

This Patch Tuesday reveals recurring themes: use-after-free errors, heap overflows, and improper input validation appear frequently, particularly in legacy components like Win32k and Ancillary Function Drivers.

Microsoft also addressed a hybrid deployment vulnerability in Exchange Server (CVE-2025-53786), recommending users apply April 2025 hotfixes for enhanced security.

For IT administrators, prioritizing patches for internet-facing systems and critical infrastructure is essential.

Home users should enable automatic updates via Windows Update. Microsoft reports no active exploits as of August 12, 2025, but history shows that publicized vulnerabilities can quickly attract threat actors.

Microsoft Patch Tuesday August 2025 – Vulnerabilities list

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates!